The present invention relates to detecting a vulnerability, and more specifically, but not exclusively, to detecting a persistent cross-site scripting vulnerability.